diff --git a/docs/delivery-audit.md b/docs/delivery-audit.md
index 00e4c30..85eef97 100644
--- a/docs/delivery-audit.md
+++ b/docs/delivery-audit.md
@@ -247,6 +247,19 @@ misconfig/degradation fail LOUD.
 
 (updated as each item lands — newest first)
 
+- **2026-07-17 — off-hardware solo work COMPLETE (35/43).** Landed this pass, each test-locked:
+  P4-8 (login CSRF), P4-6 (zone 400-not-500), P4-5 (cursor pagination), P4-7 (snapshot atomicity
+  + orphan cleanup), P5-3 (HEF in the offline bundle + fixed the broken build), P5-4 (pin + hash +
+  SBOM + install-time verify), P2-9/10/11 (keypoint confidence gating + MoveNet single-person
+  warning). phpunit 90, pytest 157 — all green.
+  REMAINING 8, none solo-doable:
+  · P1-9, P3-2b — need a DATA-MODEL decision (event dedup key + schema column; site↔device model).
+  · P2-6, P2-7, P2-8 — safety-timing / tracking-match logic that must be validated ON HARDWARE.
+    Changing them blind could make fall detection MISS events (worse than today's over-alarm,
+    which is fail-safe), so they are deliberately deferred to on-device commissioning.
+  · (P2 threshold notes: motion_thr and the sustained-prone/staleness windows are commissioning
+    knobs — tune with real camera footage on the Pi.)
+
 - **2026-07-17 — P4-6 + P4-8 landed (cloud error/auth hardening).** ZoneConfig ownership-mismatch
   now 400 not 500 (P4-6); login CSRF token now verified — closes login-CSRF/session-fixation
   (P4-8). phpunit 88 green (4 skipped: PDO). Remaining solo: P4-5 (pagination), P4-7 (atomic